Privacy Policy

Data Controller

Company name

[Company name]

Registration number

[Registration number]

Registered address

[Registered address]

Privacy contact / DPO email

[Privacy contact / DPO email]

Data Collected, Purposes And Legal Basis

2.1 Data provided directly by the User

• [GDPR art. 6(1)(b)] Name — for service personalization and communication (contract performance)
• [GDPR art. 6(1)(b)] Email address — for authentication and delivery of readings (contract performance)
• [GDPR art. 6(1)(b)] Date of birth — required for astrological/numerological calculations; constitutes personal data under GDPR (contract performance)
• [GDPR art. 6(1)(b)] Time and place of birth — for calculation accuracy (provided optionally; contract performance)
• [GDPR art. 6(1)(b)] Payment details — processed exclusively by authorized payment provider; Operator does NOT store card data
• [GDPR art. 6(1)(a)] Communications content — messages via Platform or support (consent)

2.2 Automatically collected data

• [GDPR art. 6(1)(f)] IP address, browser, device type — legitimate interest: security and fraud prevention
• [Directive 2002/58/EC] Cookies and online identifiers — with user consent (except strictly necessary cookies)
• [GDPR art. 6(1)(f)] Navigation behavior — legitimate interest: service improvement

2.3 Sensitive data note

Date of birth, time, and place of birth, while collected for astrological purposes, may indirectly indicate ethnic or religious origin. The Operator treats these with equivalent protection to special category data under GDPR art. 9 and uses them only for the stated purpose.

Legal Basis For Processing (GDPR Art. 6)

Contract performance [art. 6(1)(b)]: account data, birth data, email — necessary to provide services.

Consent [art. 6(1)(a)]: newsletter, marketing, non-essential cookies. Withdrawable at any time without consequence.

Legal obligation [art. 6(1)(c)]: financial records retention per applicable law.

Legitimate interests [art. 6(1)(f)]: security, fraud prevention, service improvement — balanced against User rights.

Retention Periods (GDPR Art. 5(1)(E) — Storage Limitation)

• Account and birth data: duration of account + 12 months post-deletion
• Financial records: as required by applicable law (minimum 5–10 years)
• Support communications: 24 months from last interaction
• Marketing data: until consent withdrawn
• IP addresses and technical logs: maximum 12 months

Data Recipients (GDPR Art. 13(1)(E))

• Authorized payment processors — transaction processing
• Hosting and cloud infrastructure providers — Platform operation
• Email marketing providers — communication (with consent)
• Public authorities — only when legally required

Commitment: We do NOT sell, rent, or transfer personal data to third parties for commercial purposes.

International Transfers (GDPR Chapter V)

Where providers are located outside the EEA, transfers are made under:

• EU Standard Contractual Clauses adopted by the European Commission, or
• European Commission adequacy decisions, or
• Other appropriate safeguards under GDPR Chapter V

User Rights

EU/EEA Users (GDPR art. 15-22):

• [art. 15] Right of access to personal data
• [art. 16] Right to rectification
• [art. 17] Right to erasure ("right to be forgotten")
• [art. 18] Right to restriction of processing
• [art. 20] Right to data portability
• [art. 21] Right to object, including to direct marketing
• [art. 22] Right not to be subject to automated decision-making

California Users (CCPA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell personal data)
• Right to non-discrimination for exercising CCPA rights

Response time: maximum 30 days (extendable by 60 days for complex requests, with notification).

Supervisory Authorities

EU users: Right to lodge complaint with local data protection authority. In Romania: ANSPDCP (www.dataprotection.ro).

California users: California Privacy Protection Agency (CPPA).

Security (GDPR Art. 32)

We implement appropriate technical and organizational measures including: HTTPS/SSL encryption, data encryption at rest and in transit, role-based access controls, internal security policies, and breach notification procedures per GDPR art. 33-34.

AI-Generated Content (Eu Ai Act 2024/1689)

Where AI systems are used to generate or assist with content, this will be explicitly disclosed to users, in compliance with applicable transparency requirements under the EU AI Act.

Changes

Material changes will be communicated by email at least 15 days before taking effect.

Effective date

[Effective date]